Add lint toolchain, generate the index page, and correct Legacy Code examples

[megabyde]

Three commits, each passing make check on its own. Review them separately; the first two are mostly mechanical and the third is the one that changes what the decks teach.

build: lint toolchain and generated index page

Adds prettier and markdownlint-cli2 behind make check, with the reformat they produce across the Legacy Code decks. Two long Exercise bullets are split and one heading is demoted from ### to ## to satisfy MD013 and MD001.

_site/index.html is no longer maintained by hand. It is built from the README Curriculum section through index.template.html and index.lua, so the tables in the README are the only place the curriculum is edited. The generated file is untracked and _site/ is ignored. The Lua filter keeps the Curriculum section, rewrites *.md#anchor deck links to .pdf, and reapplies the Bootstrap table classes; it fails the build if the Curriculum heading ever goes missing rather than publishing an empty page.

The generated page has an identical link set and row count to the previous hand-written one. Two cosmetic differences: pandoc's smart extension produces typographic quotes, matching what the beamer decks already do, and headings pick up anchor ids.

The deck glob $(wildcard **/*.md) relied on globstar, which GNU make does not implement, so it silently meant */*.md. It is now a find with -mindepth 2, which keeps README.md out and picks up decks at any depth.

ci: deploy gating and workflow permissions

Blanket workflow permissions are replaced by per-job grants, so only deploy holds pages: write and id-token: write.

build now depends on lint, so a failing make check stops the deployment on pushes to main and not only on pull requests. deploy gets a pages concurrency group so overlapping pushes cannot race. The group is job-level rather than workflow-level on purpose: this workflow also runs lint and build on pull requests, and a shared group would queue those against deployments.

npm ci with a committed lockfile replaces npm install --no-package-lock, which left transitive dependencies floating and hid them from Dependabot. actions/configure-pages is dropped: nothing consumed its outputs and page_url comes from deploy-pages.

Adds CODEOWNERS and a monthly Dependabot schedule for npm and actions.

fix: Legacy Code examples and curriculum links

• Wrap Class demonstrated inheritance, not wrapping. LoggingEngine(Engine) subclassed the legacy class and called super(). It now holds an injected Engine and delegates. The comparison table row that described the technique as Subclass is corrected to Wrapper.
• The sprouting kata asked for something sprouting cannot do. It said "do not modify the original method", but sprouting requires a minimal call site change. Reworded to ask for exactly that.
• The C++ singleton compared a pointer against null. Now nullptr.
• The invoice characterization test expected the wrong number. The calculator shown on the slide returns 2132.10 for the listed line items (500, then 1368, then 2132.1), not 1850.95.
• The tax characterization test was a tautology. It computed expected values from the same calculator it then asserted against, so it passed regardless of behaviour. It now records the six expected outputs directly.
• Two curriculum links. The Advanced TDD C++ Mars Rover link pointed at the Python repository, and the SOLID foundations worksheet was rendered to a PDF but not reachable from either the README or the site.

Not included

Actions are pinned to tags rather than commit SHAs, and the site still loads Bootstrap 3.3.7 from a CDN with SRI intact. Both are deliberate, and neither is a change I would fold into this branch.

[megabyde]

Superseded by three stacked PRs, one per commit, so the course-content corrections can be reviewed on their own rather than alongside the tooling:

• build: add lint toolchain and generate the index page #54 build: add lint toolchain and generate the index page -> main
• ci: gate deploy on lint and scope workflow permissions #55 ci: gate deploy on lint and scope workflow permissions -> build: add lint toolchain and generate the index page #54
• fix: correct Legacy Code examples, a curriculum link, and the index page title #56 fix: correct Legacy Code examples and curriculum links -> ci: gate deploy on lint and scope workflow permissions #55

Same commits, same final tree. Merge in order; GitHub retargets each to main as its base merges.